{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:OQTSVY6L73ETGAJHKGCZHVU65R","short_pith_number":"pith:OQTSVY6L","canonical_record":{"source":{"id":"1903.02837","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-07T11:12:39Z","cross_cats_sorted":["cs.CR","stat.ML"],"title_canon_sha256":"ab6e4cefb8cef782d6141bb9dc4494a21ba6eb551bf80af034e65686f12fa570","abstract_canon_sha256":"a68938a7e3eb71ef7bae1e0cedeb8482277124ec8de3af56da38a76523ccc931"},"schema_version":"1.0"},"canonical_sha256":"74272ae3cbfec9330127518593d69eec62601da83b362766cc2d7be47ef3b75d","source":{"kind":"arxiv","id":"1903.02837","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1903.02837","created_at":"2026-05-17T23:44:29Z"},{"alias_kind":"arxiv_version","alias_value":"1903.02837v2","created_at":"2026-05-17T23:44:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1903.02837","created_at":"2026-05-17T23:44:29Z"},{"alias_kind":"pith_short_12","alias_value":"OQTSVY6L73ET","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_16","alias_value":"OQTSVY6L73ETGAJH","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_8","alias_value":"OQTSVY6L","created_at":"2026-05-18T12:33:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:OQTSVY6L73ETGAJHKGCZHVU65R","target":"record","payload":{"canonical_record":{"source":{"id":"1903.02837","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-07T11:12:39Z","cross_cats_sorted":["cs.CR","stat.ML"],"title_canon_sha256":"ab6e4cefb8cef782d6141bb9dc4494a21ba6eb551bf80af034e65686f12fa570","abstract_canon_sha256":"a68938a7e3eb71ef7bae1e0cedeb8482277124ec8de3af56da38a76523ccc931"},"schema_version":"1.0"},"canonical_sha256":"74272ae3cbfec9330127518593d69eec62601da83b362766cc2d7be47ef3b75d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:44:29.066071Z","signature_b64":"ykzm+ecCsPGRteiOjiiVFUUq/feKNqi7fjZleaXQKmYmtOBHuOmhft6cuK+npDBCZYbweL5P1EUORUi3W6/yAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"74272ae3cbfec9330127518593d69eec62601da83b362766cc2d7be47ef3b75d","last_reissued_at":"2026-05-17T23:44:29.065561Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:44:29.065561Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1903.02837","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:44:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jRmusmY0CmjQ7HRNmlRsLMKaJ7k4EM7dzvkoZtuFUJmNKmTSqZLUQwxU7JpKRjioPy87DKrNYtuGHWPtYsu4Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-30T14:04:49.970341Z"},"content_sha256":"713f471f08a911e16e0ce74412f3b03c3ed1f6f5d26cf08fa8d57d942ef0e5a7","schema_version":"1.0","event_id":"sha256:713f471f08a911e16e0ce74412f3b03c3ed1f6f5d26cf08fa8d57d942ef0e5a7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:OQTSVY6L73ETGAJHKGCZHVU65R","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"The Privacy Blanket of the Shuffle Model","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","stat.ML"],"primary_cat":"cs.LG","authors_text":"Adria Gascon, Borja Balle, James Bell, Kobbi Nissim","submitted_at":"2019-03-07T11:12:39Z","abstract_excerpt":"This work studies differential privacy in the context of the recently proposed shuffle model. Unlike in the local model, where the server collecting privatized data from users can track back an input to a specific user, in the shuffle model users submit their privatized inputs to a server anonymously. This setup yields a trust model which sits in between the classical curator and local models for differential privacy. The shuffle model is the core idea in the Encode, Shuffle, Analyze (ESA) model introduced by Bittau et al. (SOPS 2017). Recent work by Cheu et al. (EUROCRYPT 2019) analyzes the d"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1903.02837","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:44:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7wB13m122vnhVi2G0A38JEyd0cmb0BCUqsq3k+JN2fW/Ycet1QjvE9gy38rymon6GfMYiA7oGPSu7z9dXvm7CQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-30T14:04:49.971129Z"},"content_sha256":"33b8a5f16a557c0a7a2fe158dae903a6948bb5aeab4a02cc325f14a5616e3505","schema_version":"1.0","event_id":"sha256:33b8a5f16a557c0a7a2fe158dae903a6948bb5aeab4a02cc325f14a5616e3505"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/OQTSVY6L73ETGAJHKGCZHVU65R/bundle.json","state_url":"https://pith.science/pith/OQTSVY6L73ETGAJHKGCZHVU65R/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/OQTSVY6L73ETGAJHKGCZHVU65R/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-30T14:04:49Z","links":{"resolver":"https://pith.science/pith/OQTSVY6L73ETGAJHKGCZHVU65R","bundle":"https://pith.science/pith/OQTSVY6L73ETGAJHKGCZHVU65R/bundle.json","state":"https://pith.science/pith/OQTSVY6L73ETGAJHKGCZHVU65R/state.json","well_known_bundle":"https://pith.science/.well-known/pith/OQTSVY6L73ETGAJHKGCZHVU65R/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:OQTSVY6L73ETGAJHKGCZHVU65R","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a68938a7e3eb71ef7bae1e0cedeb8482277124ec8de3af56da38a76523ccc931","cross_cats_sorted":["cs.CR","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-07T11:12:39Z","title_canon_sha256":"ab6e4cefb8cef782d6141bb9dc4494a21ba6eb551bf80af034e65686f12fa570"},"schema_version":"1.0","source":{"id":"1903.02837","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1903.02837","created_at":"2026-05-17T23:44:29Z"},{"alias_kind":"arxiv_version","alias_value":"1903.02837v2","created_at":"2026-05-17T23:44:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1903.02837","created_at":"2026-05-17T23:44:29Z"},{"alias_kind":"pith_short_12","alias_value":"OQTSVY6L73ET","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_16","alias_value":"OQTSVY6L73ETGAJH","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_8","alias_value":"OQTSVY6L","created_at":"2026-05-18T12:33:24Z"}],"graph_snapshots":[{"event_id":"sha256:33b8a5f16a557c0a7a2fe158dae903a6948bb5aeab4a02cc325f14a5616e3505","target":"graph","created_at":"2026-05-17T23:44:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"This work studies differential privacy in the context of the recently proposed shuffle model. Unlike in the local model, where the server collecting privatized data from users can track back an input to a specific user, in the shuffle model users submit their privatized inputs to a server anonymously. This setup yields a trust model which sits in between the classical curator and local models for differential privacy. The shuffle model is the core idea in the Encode, Shuffle, Analyze (ESA) model introduced by Bittau et al. (SOPS 2017). Recent work by Cheu et al. (EUROCRYPT 2019) analyzes the d","authors_text":"Adria Gascon, Borja Balle, James Bell, Kobbi Nissim","cross_cats":["cs.CR","stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-07T11:12:39Z","title":"The Privacy Blanket of the Shuffle Model"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1903.02837","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:713f471f08a911e16e0ce74412f3b03c3ed1f6f5d26cf08fa8d57d942ef0e5a7","target":"record","created_at":"2026-05-17T23:44:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a68938a7e3eb71ef7bae1e0cedeb8482277124ec8de3af56da38a76523ccc931","cross_cats_sorted":["cs.CR","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2019-03-07T11:12:39Z","title_canon_sha256":"ab6e4cefb8cef782d6141bb9dc4494a21ba6eb551bf80af034e65686f12fa570"},"schema_version":"1.0","source":{"id":"1903.02837","kind":"arxiv","version":2}},"canonical_sha256":"74272ae3cbfec9330127518593d69eec62601da83b362766cc2d7be47ef3b75d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"74272ae3cbfec9330127518593d69eec62601da83b362766cc2d7be47ef3b75d","first_computed_at":"2026-05-17T23:44:29.065561Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:44:29.065561Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ykzm+ecCsPGRteiOjiiVFUUq/feKNqi7fjZleaXQKmYmtOBHuOmhft6cuK+npDBCZYbweL5P1EUORUi3W6/yAw==","signature_status":"signed_v1","signed_at":"2026-05-17T23:44:29.066071Z","signed_message":"canonical_sha256_bytes"},"source_id":"1903.02837","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:713f471f08a911e16e0ce74412f3b03c3ed1f6f5d26cf08fa8d57d942ef0e5a7","sha256:33b8a5f16a557c0a7a2fe158dae903a6948bb5aeab4a02cc325f14a5616e3505"],"state_sha256":"0ec7ec58078b3f60f8d7f6fc2dfaf0bb0bd58744a3eed099e3660546bcd62409"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"39YDZWZ0lKrbuFYPwoOlPm12TbZDWFGvzENwsYkl6QmJVAs7HcX0dfsv3GudgM5fWIH5y3JHo8VdCqDhe2L7Dg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-30T14:04:49.975117Z","bundle_sha256":"84cd375b95796656ac22e6d19931ab7092bbe288ea99624b105a96568819a6c1"}}